review-anvil

SUSPICIOUS. The skill’s capabilities mostly align with its stated purpose as a review/fix orchestrator, and the referenced tools appear official or same-publisher. However, it combines untrusted external content ingestion with subagent prompting, shell execution, code modification, commits, and possible PR updates, creating a material indirect prompt-injection and autonomy risk; the transitive installation of companion skills adds further trust exposure. I found no confirmed malware indicators, covert exfiltration endpoint, dangerous pre-execution directive, or obviously incompatible credential-harvesting behavior.